The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
References
Link | Resource |
---|---|
https://github.com/democritus-project/d8s-math/issues/11 | Exploit Issue Tracking Third Party Advisory |
https://pypi.org/project/d8s-math/ | Product |
https://pypi.org/project/democritus-strings/ | Product |
https://github.com/democritus-project/d8s-math/issues/11 | Exploit Issue Tracking Third Party Advisory |
https://pypi.org/project/d8s-math/ | Product |
https://pypi.org/project/democritus-strings/ | Product |
Configurations
History
21 Nov 2024, 07:17
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/democritus-project/d8s-math/issues/11 - Exploit, Issue Tracking, Third Party Advisory | |
References | () https://pypi.org/project/d8s-math/ - Product | |
References | () https://pypi.org/project/democritus-strings/ - Product |
Information
Published : 2022-09-19 16:15
Updated : 2024-11-21 07:17
NVD link : CVE-2022-38883
Mitre link : CVE-2022-38883
CVE.ORG link : CVE-2022-38883
JSON object : View
Products Affected
d8s-math_project
- d8s-math
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type